# Method DELETE is not allowed by Access-Control-Allow-Methods in preflight response.

**URL:** <https://community.hubspot.com/t/method-delete-is-not-allowed-by-access-control-allow-methods-in-preflight-response/54374>\
**Category:** CMS Development\
**Tags:** hubdb, javascript\
**Created:** [April 4, 2022, 5:53pm UTC](https://community.hubspot.com/t/method-delete-is-not-allowed-by-access-control-allow-methods-in-preflight-response/54374 "2022-04-04T17:53:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![SSawant](https://avatars.discourse-cdn.com/v4/letter/s/3da27b/32.png) [@SSawant](https://community.hubspot.com/u/SSawant)\
**Post date:** [April 4, 2022, 5:53pm UTC](https://community.hubspot.com/t/method-delete-is-not-allowed-by-access-control-allow-methods-in-preflight-response/54374/1 "2022-04-04T17:53:28Z")

</div>

```auto
var settings = {
 "url": "url link",
 "method": "DELETE",
 "timeout": 0,
};

$.ajax(settings).done(function (response) {
 console.log(response);
});

```

The above code was generated from postman. When I send a request via postman app, it works; however, when I post the same code generated from postman on my app, it throws an error.

```auto
 $.ajax({
 url: "url link",,
 type: 'DELETE',
 headers: {
 'Access-Control-Allow-Origin': '*',
 'Access-Control-Allow-Headers': 'Origin, X-Requested-With, Content-Type, Accept, Z-Key',
 'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS',
 "Content-type": "application/json",
 "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36"

 },
 success: function(result) {
 console.log("deleted");
 console.log(result);
 }
});

```

I have even tried the above code by setting ‘Access-Control-Allow-Methods’: ‘GET, POST, PUT, DELETE, OPTIONS’. But I still receive the same error: “Method DELETE is not allowed by Access-Control-Allow-Methods in preflight response.”

---

<div class="post-metadata">

**Author:** ![dennisedson](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/dennisedson/32/28044_2.png) [@dennisedson](https://community.hubspot.com/u/dennisedson)\
**Post date:** [April 5, 2022, 4:04pm UTC](https://community.hubspot.com/t/method-delete-is-not-allowed-by-access-control-allow-methods-in-preflight-response/54374/2 "2022-04-05T16:04:15Z")

</div>

@stefen ,

Didn’t you write something up about this at one point or am I making it up?

---

<div class="post-metadata">

**Author:** ![stefen](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/stefen/32/29274_2.png) [@stefen](https://community.hubspot.com/u/stefen)\
**Post date:** [April 5, 2022, 4:06pm UTC](https://community.hubspot.com/t/method-delete-is-not-allowed-by-access-control-allow-methods-in-preflight-response/54374/3 "2022-04-05T16:06:55Z")

</div>

@dennisedson @SSawant haha yep! The majority of HubSpot APIs do not allow client side cross origin requests so you have to setup an intermediate server to handle that for you. here’s the article I wrote: [How to Enable CORS/AJAX Requests for any HubSpot API](https://www.kelp.agency/blog/how-to-enable-cors-ajax-requests-for-any-hubspot-api)

---

<div class="post-metadata">

**Author:** ![dennisedson](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/dennisedson/32/28044_2.png) [@dennisedson](https://community.hubspot.com/u/dennisedson)\
**Post date:** [April 5, 2022, 4:07pm UTC](https://community.hubspot.com/t/method-delete-is-not-allowed-by-access-control-allow-methods-in-preflight-response/54374/4 "2022-04-05T16:07:46Z")

</div>

Good to know I am not crazy! Thanks!